We used to not set the guard state in launch_direct_bridge_descriptor_fetch(). So when a bridge descriptor fetch failed, the guard subsystem would never learn about the fail (and hence the guard's reachability state would not be updated).
George Kadianakis